When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-apache2 | Apr 2, 2018 | Mar 26, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | May 4, 2018 | Mar 23, 2018 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Mar 26, 2018 | Mar 26, 2018 |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 26, 2018 |
| Debian | debian-upgrade-apache2 | Jul 30, 2024 | Mar 26, 2018 | |
| Freebsd | freebsd-upgrade-package-apache24freebsd-upgrade-package-apache22 | Mar 25, 2018 | Mar 24, 2018 | |
| Hpux | — | hpux-update-hpuxwsapache | Mar 28, 2022 | Mar 26, 2018 |
| Ibm Http_server | — | ibm-http_server-apply-fix-pack-9_0_0_8 | Aug 6, 2018 | Mar 26, 2018 |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-server-apache-24-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-dbd-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ldap-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-lua-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-33-0-175-3-32-0-3-0 | May 16, 2018 | Mar 26, 2018 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Mar 26, 2018 |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | May 8, 2018 | Mar 23, 2018 |
| Ubuntu | ubuntu-upgrade-apache2-bin | Oct 16, 2018 | Mar 23, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub